Critical · published January 10, 2026
🚨 A guest user could trigger a SQL injection just by glancing at a calendar! This vulnerability in XWiki's Full Calendar Macro puts exposed database information and potential DoS attacks within reach of even the most casual visitors. 🔥 Think of it as a public bulletin board that not only displays event times but also lets anyone who stops by rummage through important files behind the scenes. If left unchecked, it’s like handing out the keys to sensitive data! An attacker could exploit this vulnerability to extract sensitive information from the database or even crash the calendar service entirely, leading to disruption for all users. It’s an absolute game-changer if an unauthorized individual gains access and operates unchecked!
Think of it as a public bulletin board that not only displays event times but also lets anyone who stops by rummage through important files behind the scenes. If left unchecked, it’s like handing out the keys to sensitive data! This SQL injection vulnerability arises because the Calendar.JSONService page does not properly sanitize input, allowing attackers to inject malicious SQL queries and interact with the database directly.
An attacker could exploit this vulnerability to extract sensitive information from the database or even crash the calendar service entirely, leading to disruption for all users. It’s an absolute game-changer if an unauthorized individual gains access and operates unchecked! Immediately update to version 2.4.5 or higher to close this security gap. Additionally, review user permissions on the Calendar.JSONService page to ensure that guest users cannot access sensitive data. Regularly audit your database interactions to ensure robust security! You've got this! With the right steps, you’ll be a security hero in no time! 🛡️